···463463464464The key to use when specifying the prefix. By default, this is set to `--prefix=` as that is used by the majority of packages.
465465466466+##### `dontAddStaticConfigureFlags`
467467+468468+By default, when building statically, stdenv will try to add build system appropriate configure flags to try to enable static builds.
469469+470470+If this is undesirable, set this variable to true.
471471+466472##### `dontAddDisableDepTrack` {#var-stdenv-dontAddDisableDepTrack}
467473468474By default, the flag `--disable-dependency-tracking` is added to the configure flags to speed up Automake-based builds. If this is undesirable, set this variable to true.
···475481476482By default, when the configure script has `--enable-static`, the option `--disable-static` is added to the configure flags.
477483478478-If this is undesirable, set this variable to true.
484484+If this is undesirable, set this variable to true. It is automatically set to true when building statically, for example through `pkgsStatic`.
479485480486##### `configurePlatforms` {#var-stdenv-configurePlatforms}
481487
···5252 };
53535454 port = mkOption {
5555- type = types.int;
5555+ type = types.port;
5656 default = 6379;
5757 description = "The port for Redis to listen to.";
5858 };
+2-2
nixos/modules/services/games/terraria.nix
···4242 };
43434444 port = mkOption {
4545- type = types.int;
4545+ type = types.port;
4646 default = 7777;
4747 description = ''
4848 Specifies the port to listen on.
···5050 };
51515252 maxPlayers = mkOption {
5353- type = types.int;
5353+ type = types.ints.u8;
5454 default = 255;
5555 description = ''
5656 Sets the max number of players (between 1 and 255).
+1-1
nixos/modules/services/misc/gitlab.nix
···462462 };
463463464464 port = mkOption {
465465- type = types.int;
465465+ type = types.port;
466466 default = 8080;
467467 description = ''
468468 GitLab server port for copy-paste URLs, e.g. 80 or 443 if you're
+1-1
nixos/modules/services/misc/matrix-synapse.nix
···238238 type = types.listOf (types.submodule {
239239 options = {
240240 port = mkOption {
241241- type = types.int;
241241+ type = types.port;
242242 example = 8448;
243243 description = ''
244244 The port to listen for HTTP(S) requests on.
···6767 };
68686969 listen.port = mkOption {
7070- type = types.int;
7070+ type = types.port;
7171 default = 5000;
7272 description = ''
7373 Port on which the sync server listen to.
+1-1
nixos/modules/services/networking/git-daemon.nix
···7474 };
75757676 port = mkOption {
7777- type = types.int;
7777+ type = types.port;
7878 default = 9418;
7979 description = "Port to listen on.";
8080 };
···110110 };
111111112112 rpc.port = mkOption {
113113- type = types.int;
113113+ type = types.port;
114114 default = 18081;
115115 description = ''
116116 Port the RPC server will bind to.
+1-1
nixos/modules/services/web-apps/discourse.nix
···356356 };
357357358358 port = lib.mkOption {
359359- type = lib.types.int;
359359+ type = lib.types.port;
360360 default = 25;
361361 description = ''
362362 The port of the SMTP server Discourse should use to
+1-1
nixos/modules/services/web-servers/darkhttpd.nix
···19192020 port = mkOption {
2121 default = 80;
2222- type = ints.u16;
2222+ type = types.port;
2323 description = ''
2424 Port to listen on.
2525 Pass 0 to let the system choose any free port for you.
···134134135135 port = mkOption {
136136 default = 80;
137137- type = types.int;
137137+ type = types.port;
138138 description = ''
139139 TCP port number for lighttpd to bind to.
140140 '';
···2020 source @out@/nix-support/add-flags.sh
2121fi
22222323-setDynamicLinker=1
24232524# Optionally filter out paths not refering to the store.
2625expandResponseParams "$@"
2626+2727+# NIX_LINK_TYPE is set if ld has been called through our cc wrapper. We take
2828+# advantage of this to avoid both recalculating it, and also repeating other
2929+# processing cc wrapper has already done.
3030+if [[ -n "${NIX_LINK_TYPE_@suffixSalt@:-}" ]]; then
3131+ linkType=$NIX_LINK_TYPE_@suffixSalt@
3232+else
3333+ linkType=$(checkLinkType "$@")
3434+fi
3535+2736if [[ "${NIX_ENFORCE_PURITY:-}" = 1 && -n "${NIX_STORE:-}"
2828- && ( -z "$NIX_IGNORE_LD_THROUGH_GCC_@suffixSalt@" || -z "${NIX_LDFLAGS_SET_@suffixSalt@:-}" ) ]]; then
3737+ && ( -z "$NIX_IGNORE_LD_THROUGH_GCC_@suffixSalt@" || -z "${NIX_LINK_TYPE_@suffixSalt@:-}" ) ]]; then
2938 rest=()
3039 nParams=${#params[@]}
3140 declare -i n=0
4141+3242 while (( "$n" < "$nParams" )); do
3343 p=${params[n]}
3444 p2=${params[n+1]:-} # handle `p` being last one
···4858 # Our ld is not built with sysroot support (Can we fix that?)
4959 :
5060 else
5151- if [[ "$p" = -static || "$p" = -static-pie ]]; then
5252- # Using a dynamic linker for static binaries can lead to crashes.
5353- # This was observed for rust binaries.
5454- setDynamicLinker=0
5555- fi
5661 rest+=("$p")
5762 fi
5863 n+=1
···6065 # Old bash empty array hack
6166 params=(${rest+"${rest[@]}"})
6267fi
6868+63696470source @out@/nix-support/add-hardening.sh
65716672extraAfter=()
6773extraBefore=(${hardeningLDFlags[@]+"${hardeningLDFlags[@]}"})
68746969-if [ -z "${NIX_LDFLAGS_SET_@suffixSalt@:-}" ]; then
7070- extraAfter+=($NIX_LDFLAGS_@suffixSalt@)
7171- extraBefore+=($NIX_LDFLAGS_BEFORE_@suffixSalt@)
7575+if [ -z "${NIX_LINK_TYPE_@suffixSalt@:-}" ]; then
7676+ extraAfter+=($(filterRpathFlags "$linkType" $NIX_LDFLAGS_@suffixSalt@))
7777+ extraBefore+=($(filterRpathFlags "$linkType" $NIX_LDFLAGS_BEFORE_@suffixSalt@))
7878+7279 # By adding dynamic linker to extraBefore we allow the users set their
7380 # own dynamic linker as NIX_LD_FLAGS will override earlier set flags
7474- if [[ "$setDynamicLinker" = 1 && -n "$NIX_DYNAMIC_LINKER_@suffixSalt@" ]]; then
8181+ if [[ "$linkType" == dynamic && -n "$NIX_DYNAMIC_LINKER_@suffixSalt@" ]]; then
7582 extraBefore+=("-dynamic-linker" "$NIX_DYNAMIC_LINKER_@suffixSalt@")
7683 fi
7784fi
78857979-extraAfter+=($NIX_LDFLAGS_AFTER_@suffixSalt@)
8686+extraAfter+=($(filterRpathFlags "$linkType" $NIX_LDFLAGS_AFTER_@suffixSalt@))
80878188# These flags *must not* be pulled up to -Wl, flags, so they can't go in
8289# add-flags.sh. They must always be set, so must not be disabled by
···173180 prev="$p"
174181done
175182176176-if [[ "$link32" = "1" && "$setDynamicLinker" = 1 && -e "@out@/nix-support/dynamic-linker-m32" ]]; then
183183+if [[ "$link32" == "1" && "$linkType" == dynamic && -e "@out@/nix-support/dynamic-linker-m32" ]]; then
177184 # We have an alternate 32-bit linker and we're producing a 32-bit ELF, let's
178185 # use it.
179186 extraAfter+=(
···183190fi
184191185192# Add all used dynamic libraries to the rpath.
186186-if [ "$NIX_DONT_SET_RPATH_@suffixSalt@" != 1 ]; then
193193+if [[ "$NIX_DONT_SET_RPATH_@suffixSalt@" != 1 && "$linkType" != static-pie ]]; then
187194 # For each directory in the library search path (-L...),
188195 # see if it contains a dynamic library used by a -l... flag. If
189196 # so, add the directory to the rpath.
+7-8
pkgs/build-support/cc-wrapper/cc-wrapper.sh
···2929cxxInclude=1
3030cxxLibrary=1
3131cInclude=1
3232-setDynamicLinker=1
33323433expandResponseParams "$@"
3434+linkType=$(checkLinkType "$@")
3535+3536declare -i n=0
3637nParams=${#params[@]}
3738while (( "$n" < "$nParams" )); do
···6061 cxxInclude=0
6162 elif [ "$p" = -nostdinc++ ]; then
6263 cxxInclude=0
6363- elif [[ "$p" = -static || "$p" = -static-pie ]]; then
6464- setDynamicLinker=0
6564 elif [[ "$p" != -?* ]]; then
6665 # A dash alone signifies standard input; it is not a flag
6766 nonFlagArgs=1
···151150152151 # Add the flags that should only be passed to the compiler when
153152 # linking.
154154- extraAfter+=($NIX_CFLAGS_LINK_@suffixSalt@)
153153+ extraAfter+=($(filterRpathFlags "$linkType" $NIX_CFLAGS_LINK_@suffixSalt@))
155154156155 # Add the flags that should be passed to the linker (and prevent
157156 # `ld-wrapper' from adding NIX_LDFLAGS_@suffixSalt@ again).
158158- for i in $NIX_LDFLAGS_BEFORE_@suffixSalt@; do
157157+ for i in $(filterRpathFlags "$linkType" $NIX_LDFLAGS_BEFORE_@suffixSalt@); do
159158 extraBefore+=("-Wl,$i")
160159 done
161161- if [[ "$setDynamicLinker" = 1 && -n "$NIX_DYNAMIC_LINKER_@suffixSalt@" ]]; then
160160+ if [[ "$linkType" == dynamic && -n "$NIX_DYNAMIC_LINKER_@suffixSalt@" ]]; then
162161 extraBefore+=("-Wl,-dynamic-linker=$NIX_DYNAMIC_LINKER_@suffixSalt@")
163162 fi
164164- for i in $NIX_LDFLAGS_@suffixSalt@; do
163163+ for i in $(filterRpathFlags "$linkType" $NIX_LDFLAGS_@suffixSalt@); do
165164 if [ "${i:0:3}" = -L/ ]; then
166165 extraAfter+=("$i")
167166 else
168167 extraAfter+=("-Wl,$i")
169168 fi
170169 done
171171- export NIX_LDFLAGS_SET_@suffixSalt@=1
170170+ export NIX_LINK_TYPE_@suffixSalt@=$linkType
172171fi
173172174173# As a very special hack, if the arguments are just `-v', then don't
+35
pkgs/build-support/wrapper-common/utils.bash
···129129 fi
130130 done
131131}
132132+133133+checkLinkType() {
134134+ local arg mode
135135+ type="dynamic"
136136+ for arg in "$@"; do
137137+ if [[ "$arg" = -static ]]; then
138138+ type="static"
139139+ elif [[ "$arg" = -static-pie ]]; then
140140+ type="static-pie"
141141+ fi
142142+ done
143143+ echo "$type"
144144+}
145145+146146+# When building static-pie executables we cannot have rpath
147147+# set. At least glibc requires rpath to be empty
148148+filterRpathFlags() {
149149+ local linkType=$1 ret="" i
150150+ shift
151151+152152+ if [[ "$linkType" == "static-pie" ]]; then
153153+ while [[ "$#" -gt 0 ]]; do
154154+ i="$1"; shift 1
155155+ if [[ "$i" == -rpath ]]; then
156156+ # also skip its argument
157157+ shift
158158+ else
159159+ ret+="$i "
160160+ fi
161161+ done
162162+ else
163163+ ret=$@
164164+ fi
165165+ echo $ret
166166+}
···125125 # upstream patch. Don't forget to check backport status of the upstream patch
126126 # when adding new GHC releases in nixpkgs.
127127 ./respect-ar-path.patch
128128+ # Fix documentation configuration which causes a syntax error with sphinx 4.*
129129+ # See https://gitlab.haskell.org/ghc/ghc/-/issues/19962, remove at 8.10.6.
130130+ ./sphinx-4-configuration.patch
128131 ] ++ lib.optionals stdenv.isDarwin [
129132 # Make Block.h compile with c++ compilers. Remove with the next release
130133 (fetchpatch {
+3
pkgs/development/compilers/ghc/8.8.4.nix
···134134 # upstream patch. Don't forget to check backport status of the upstream patch
135135 # when adding new GHC releases in nixpkgs.
136136 ./respect-ar-path.patch
137137+ # Fix documentation configuration which causes a syntax error with sphinx 4.*
138138+ # See also https://gitlab.haskell.org/ghc/ghc/-/issues/19962
139139+ ./sphinx-4-configuration.patch
137140 ];
138141139142 postPatch = "patchShebangs .";
···13131414buildPythonPackage rec {
1515 pname = "botocore";
1616- version = "1.20.88"; # N.B: if you change this, change boto3 and awscli to a matching version
1616+ version = "1.20.97"; # N.B: if you change this, change boto3 and awscli to a matching version
17171818 src = fetchPypi {
1919 inherit pname version;
2020- sha256 = "sha256-vJie2rUtR4iq3Y0a/5JfXGp8vGiQC/2443mWWurBcxc=";
2020+ sha256 = "f7e119cf3e0f4a36100f0e983583afa91a84fb27c479a1716820aee4f2e190ab";
2121 };
22222323 propagatedBuildInputs = [
···991010buildPythonPackage rec {
1111 pname = "docutils";
1212- version = "0.16";
1212+ version = "0.17.1";
13131414 src = fetchPypi {
1515 inherit pname version;
1616- sha256 = "c2de3a60e9e7d07be26b7f2b00ca0309c207e06c100f9cc2a94931fc75a478fc";
1616+ sha256 = "686577d2e4c32380bb50cbb22f575ed742d58168cee37e99117a854bcd88f125";
1717 };
18181919 # Only Darwin needs LANG, but we could set it in general.
···18181919buildPythonPackage rec {
2020 pname = "entrance";
2121- version = "1.1.15";
2121+ version = "1.1.17";
22222323 src = fetchPypi {
2424 inherit pname version;
2525- sha256 = "5b354ecf03226edae567511c8a8db95038cc9c3da20fcfcf5546d1e197eb3aef";
2525+ sha256 = "dee5b4f3330f633fcd4e665f1781bf6e53b375ffdc7a24434257dfba6b1c2d7f";
2626 };
27272828 # The versions of `sanic` and `websockets` in nixpkgs only support 3.6 or later
···4444 uvicorn
4545 ];
46464747- postPatch = ''
4848- # The anyio 3.1.0 release is not picked-up proberly
4949- substituteInPlace setup.py --replace "anyio==3.*" "anyio"
5050- '';
5151-5252-5347 disabledTestPaths = [
5448 # these tests fail during dns lookups: httpcore.ConnectError: [Errno -2] Name or service not known
5549 "tests/test_threadsafety.py"
···1818 # If you need these, you can just add them to your environment.
19192020 pname = "hypothesis";
2121- version = "5.49.0";
2121+ version = "6.14.0";
22222323 # Use github tarballs that includes tests
2424 src = fetchFromGitHub {
2525 owner = "HypothesisWorks";
2626 repo = "hypothesis-python";
2727 rev = "hypothesis-python-${version}";
2828- sha256 = "1lr9a93vdx70s9i1zazazif5hy8fbqhvwqq402ygpf53yw4lgi2w";
2828+ sha256 = "0yns81j3fnpdfaphk722xcnidqhgy0kmd7ik6aw7l795l0wivhxj";
2929 };
30303131 postUnpack = "sourceRoot=$sourceRoot/hypothesis-python";
···11+From b36083efafec5a3c1c5864cd0b62367ddf3856ae Mon Sep 17 00:00:00 2001
22+From: Keshav Kini <keshav.kini@gmail.com>
33+Date: Sun, 16 May 2021 20:35:24 -0700
44+Subject: [PATCH] Prefer NixOS/Nix default CA bundles over certifi
55+66+Normally, requests gets its default CA bundle from the certifi
77+package. On NixOS and when using Nix on non-NixOS platforms, we would
88+rather default to using our own certificate bundles controlled by the
99+Nix/NixOS user.
1010+1111+This commit overrides requests.certs.where(), which previously was
1212+just aliased to certifi.where(), so that now it does the following:
1313+1414+- When run by Nix on non-NixOS, the environment variable
1515+ $NIX_SSL_CERT_FILE will point to the CA bundle we're using, so we
1616+ use that.
1717+1818+- When running on NixOS, the CA bundle we're using has the static path
1919+ /etc/ssl/certs/ca-certificates.crt , so we use that.
2020+2121+- Otherwise, we fall back to the original behavior of using certifi's
2222+ CA bundle. Higher in the call stack, users of requests can also
2323+ explicitly specify a CA bundle to use, which overrides all this
2424+ logic.
2525+---
2626+ requests/certs.py | 18 +++++++++++++++++-
2727+ 1 file changed, 17 insertions(+), 1 deletion(-)
2828+2929+diff --git a/requests/certs.py b/requests/certs.py
3030+index d1a378d7..faf462b7 100644
3131+--- a/requests/certs.py
3232++++ b/requests/certs.py
3333+@@ -12,7 +12,23 @@ If you are packaging Requests, e.g., for a Linux distribution or a managed
3434+ environment, you can change the definition of where() to return a separately
3535+ packaged CA bundle.
3636+ """
3737+-from certifi import where
3838++
3939++import os
4040++
4141++import certifi
4242++
4343++
4444++def where():
4545++ nix_ssl_cert_file = os.getenv("NIX_SSL_CERT_FILE")
4646++ if nix_ssl_cert_file and os.path.exists(nix_ssl_cert_file):
4747++ return nix_ssl_cert_file
4848++
4949++ nixos_ca_bundle = "/etc/ssl/certs/ca-certificates.crt"
5050++ if os.path.exists(nixos_ca_bundle):
5151++ return nixos_ca_bundle
5252++
5353++ return certifi.where()
5454++
5555+5656+ if __name__ == '__main__':
5757+ print(where())
5858+--
5959+2.31.1
6060+
···11{ fetchPypi, buildPythonPackage, lib }:
2233buildPythonPackage rec {
44- version = "3.10.3";
44+ version = "3.10.5";
55 pname = "thespian";
6677 src = fetchPypi {
88 inherit pname version;
99 extension = "zip";
1010- sha256 = "d9152089f239c80339eb0431b9561966a841fb3ab0d043b36fa47934fc7956f2";
1010+ sha256 = "17adad8afbc4779a01f34a6595c63fceccfd21f10556b85a261338eb99b5d306";
1111 };
12121313 # Do not run the test suite: it takes a long time and uses
···1717my %pkgURLs;
1818my %pkgHashes;
1919my %pkgNames;
2020+my %pkgVersions;
2021my %pkgRequires;
2122my %pkgNativeRequires;
2223···7374 next;
7475 }
75767777+ # split by first occurence of hyphen followd by only numbers ends line or another hyphen follows
7878+ my ($name, $version) = split(/-(?=[.0-9]+(?:$|-))/, $pkgName, 2);
7979+7680 $pkgURLs{$pkg} = $tarball;
7777- $pkgNames{$pkg} = $pkgName;
8181+ $pkgNames{$pkg} = $name;
8282+ $pkgVersions{$pkg} = $version;
78837984 my $cachePath = catdir($downloadCache, basename($tarball));
8085 my $hash;
···303308 print OUT <<EOF
304309 # THIS IS A GENERATED FILE. DO NOT EDIT!
305310 $pkg = callPackage ({ $argumentsStr }: stdenv.mkDerivation {
306306- name = "$pkgNames{$pkg}";
311311+ pname = "$pkgNames{$pkg}";
312312+ version = "$pkgVersions{$pkg}";
307313 builder = ./builder.sh;
308314 src = fetchurl {
309315 url = "$pkgURLs{$pkg}";
+1-1
pkgs/servers/x11/xorg/overrides.nix
···668668 ( # assert() keeps runtime reference xorgserver-dev in xf86-video-intel and others
669669 cd "$dev"
670670 for f in include/xorg/*.h; do
671671- sed "1i#line 1 \"${attrs.name}/$f\"" -i "$f"
671671+ sed "1i#line 1 \"${attrs.pname}-${attrs.version}/$f\"" -i "$f"
672672 done
673673 )
674674 '';
···3535 printf "checking whether compiler builds valid static C binaries... " >&2
3636 $CC ${staticLibc} -static -o cc-static ${./cc-main.c}
3737 ./cc-static
3838- # our glibc does not have pie enabled yet.
3939- ${lib.optionalString (stdenv.hostPlatform.isMusl && stdenv.cc.isGNU) ''
3838+ ${lib.optionalString (stdenv.cc.isGNU && lib.versionAtLeast (lib.getVersion stdenv.cc.name) "8.0.0") ''
4039 printf "checking whether compiler builds valid static pie C binaries... " >&2
4140 $CC ${staticLibc} -static-pie -o cc-static-pie ${./cc-main.c}
4241 ./cc-static-pie
+2-2
pkgs/tools/admin/awscli/default.nix
···2121in
2222with py.pkgs; buildPythonApplication rec {
2323 pname = "awscli";
2424- version = "1.19.88"; # N.B: if you change this, change botocore and boto3 to a matching version too
2424+ version = "1.19.97"; # N.B: if you change this, change botocore and boto3 to a matching version too
25252626 src = fetchPypi {
2727 inherit pname version;
2828- sha256 = "sha256-LfWSE3dDTJ0BHcaaY49Nd9RAZgj5b++NFeYhkIfwQX0=";
2828+ sha256 = "sha256-kecuyQMk4GWH9G0/f4Gi/hWtW4Zme9Q4i7XclcZTlNc=";
2929 };
30303131 # https://github.com/aws/aws-cli/issues/4837
···2121 buildCommand = "sed s/dot_root/agroot/g ${raw_patch} > $out";
2222 };
2323 # 2.42 has the patch included
2424- patches = optional (lib.versionOlder version "2.42") patchToUse;
2424+ patches = optional (lib.versionOlder version "2.42") patchToUse
2525+ ++ optionals (lib.versionOlder version "2.46.0") [
2626+ (fetchpatch {
2727+ name = "CVE-2020-18032.patch";
2828+ url = "https://gitlab.com/graphviz/graphviz/-/commit/784411ca3655c80da0f6025ab20634b2a6ff696b.patch";
2929+ sha256 = "1nkw9ism8lkfvxsp5fh95i2l5s5cbjsidbb3g1kjfv10rxkyb41m";
3030+ })
3131+ ];
2532in
26332734stdenv.mkDerivation {
+6-5
pkgs/tools/misc/coreutils/default.nix
···6868 for f in gnulib-tests/{test-chown.c,test-fchownat.c,test-lchown.c}; do
6969 echo "int main() { return 77; }" > "$f"
7070 done
7171+7272+ # tests try to access user 1000 which is forbidden in sandbox
7373+ sed '2i print "Skipping id uid test"; exit 77' -i ./tests/id/uid.sh
7474+ sed '2i print "Skipping id zero test"; exit 77' -i ./tests/id/zero.sh
7575+ sed '2i print "Skipping misc help-versiob test"; exit 77' -i ./tests/misc/help-version.sh
7676+ sed '2i print "Skipping chown separator test"; exit 77' -i ./tests/chown/separator.sh
7177 '' + optionalString (stdenv.hostPlatform.libc == "musl") (lib.concatStringsSep "\n" [
7278 ''
7379 echo "int main() { return 77; }" > gnulib-tests/test-parse-datetime.c
···136142 meta = {
137143 homepage = "https://www.gnu.org/software/coreutils/";
138144 description = "The basic file, shell and text manipulation utilities of the GNU operating system";
139139-140145 longDescription = ''
141146 The GNU Core Utilities are the basic file, shell and text
142147 manipulation utilities of the GNU operating system. These are
143148 the core utilities which are expected to exist on every
144149 operating system.
145150 '';
146146-147151 license = licenses.gpl3Plus;
148148-149152 platforms = platforms.unix ++ platforms.windows;
150150-151153 priority = 10;
152152-153154 maintainers = [ maintainers.eelco ];
154155 };
155156} // optionalAttrs stdenv.hostPlatform.isMusl {